diff --git a/secrets/kuribo/papermario-dx-build.json b/secrets/kuribo/papermario-dx-build.json
new file mode 100644
index 0000000..03d253c
--- /dev/null
+++ b/secrets/kuribo/papermario-dx-build.json
@@ -0,0 +1,25 @@
+{
+	"baseromUrl": "ENC[AES256_GCM,data:GQ8LVJL17pJ8kzdxU7YEnus3ZX7gBO95xdcAGJGMq043fnURqRb21++CAWTFm+/XICm+DfiuFA8pHMKEp0MvNlD5mIGDFBtmzTIaPn11QCM=,iv:+EHYAWbGl1bTemYluxDAO4E0a4SbDHbMwuA+k2+iIbI=,tag:o0BvKJO1Zp6graujgHWv9Q==,type:str]",
+	"sccache": {
+		"endpoint": "ENC[AES256_GCM,data:Lc7hXbrtT6j35iS9sNgPUwnEhsP8snvQVtoq,iv:H2QpjDD90+Q+T814OFPwUn621k90udGqTGpEDIZcjXE=,tag:qiG4+dwxkMJzO/vJ64vj9g==,type:str]",
+		"bucket": "ENC[AES256_GCM,data:MkQxbbWDpQ==,iv:DPDVjzgn0YbWrPouFTlFVOz/ghersSBSr7HzQB6+IZ0=,tag:y0NJvelED0c1fzX9Ypx8HQ==,type:str]",
+		"accessKey": "ENC[AES256_GCM,data:PgxncgfKg71JpvNI3zcDVsLxfbQ=,iv:XwlfbtxievXT0GDQBUOWvcW/dX1nt/VJaFVKCKLRuSc=,tag:q9GedCxhCKV3ex9UvxdCNA==,type:str]",
+		"secretKey": "ENC[AES256_GCM,data:zUHw1WEZSLOb9N/5eKIp/q0kjtxgWXzNv7dQVClQ0wvzT4TOwe5olg==,iv:lZ8t8hio9vuWmMaqU75VLQyiq4G0Mi0DSdo3Ma3oLDc=,tag:LDi7HDQ5HV2tevL3sXJ8Qw==,type:str]"
+	},
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1h08rnd0jeddf55l6l3rf6dlwwh7mngcxy92tyz0hfysjqx4wvgrq6vmah2",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZWGwyd2pUL2hNU1VYMVEy\nT0p1ZEpML1dOK1ZoK3Bscks5RldteFJtMUdNCjFhcXFjR01IVEE4d0p1K2k3c2lN\nTnM3Vm91dGEwaEVTRkhodUZINEtmdVEKLS0tIDY1cTR0OXJzeSs1LzNLbXdLMDdR\na1VneTZlOXlTVXppMGF5OUZZckpGaVUKMRGVmtHhfHs4c8Qnv7cntCRccrh4kHLI\ns+Xu4KSiqW+xTgBB6QKeDypRoDWUk3Jzm6uYqZdfWbCFxbSURrkZow==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1dhxleu7puseq4fz5gprzdssprdd452kjry2n47xaqfh22p5eyqfs68zysl",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3VDVPSDFrdzYxTHJYTkZM\nTTF0Yk1WWDJVbllwaU5tdjhtb2VyYWhiemxNCjRvVHB4YjRHNXlYU1VSanEyUW4y\nUnlUbTdxZEM5dkNMTFpPOVlJbEozS1UKLS0tIGxoRTNxbVVJTWFuOVdPRmU0VmNE\nc0IrQ01LNzFRaklsRWI1THlBSDA4Y1UKVJvM77yd9kp0Q6nOkcrxq6aTANEo898W\nAphZshPVi9wG3AdZnAtkXbhB5V0nnsv098RYgt0u70WYADjw5BVPkQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-03-22T16:44:04Z",
+		"mac": "ENC[AES256_GCM,data:W9PQ84hRNsFl8aBZ7UN09kackvj9k3HIY7o3JGmO2GjEP6tlO5/4Pr9xPQHn5MiPLsO15ghYl5nVkgcoBpOZCuePbzqZtv44SSW4+/DfygpfrT/yhE/UkkeHfifZzbLM09tOnxQEuOFto+oBttPJo9UzFUMXBmnleXZvqv4fr7U=,iv:7hybudHPn5PU7Rq9WqGMEf/MQ3gplyshSCZfMLqcIuY=,tag:VdhS0wewnaRqarwWdXmQeQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.11.0"
+	}
+}
diff --git a/servers/kuribo/caddy.nix b/servers/kuribo/caddy.nix
new file mode 100644
index 0000000..46a8399
--- /dev/null
+++ b/servers/kuribo/caddy.nix
@@ -0,0 +1,78 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.starhaven.caddy;
+in
+{
+  options.starhaven.caddy = {
+    extraHandles = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = "Extra handle blocks for the *.starhaven.dev virtualHost. These are placed before the fallback handler.";
+    };
+    fallbackHandle = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = "Fallback handle block (catch-all, placed last).";
+    };
+    adminEmail = lib.mkOption {
+      type = lib.types.str;
+      default = "admin@starhaven.dev";
+    };
+  };
+
+  config = {
+    services.caddy = {
+      enable = true;
+      package = pkgs.caddy.withPlugins {
+        plugins = [ "github.com/caddy-dns/cloudflare@v0.2.2" ];
+        hash = "sha256-ea8PC/+SlPRdEVVF/I3c1CBprlVp1nrumKM5cMwJJ3U=";
+      };
+      email = cfg.adminEmail;
+      globalConfig = ''
+        on_demand_tls {
+          ask http://127.0.0.1:8081
+        }
+
+        acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+      '';
+      virtualHosts."*.starhaven.dev" = {
+        extraConfig = ''
+          tls {
+            on_demand
+          }
+
+          handle / {
+            redir https://starhaven.dev
+          }
+
+          ${cfg.extraHandles}
+
+          ${cfg.fallbackHandle}
+        '';
+      };
+    };
+
+    environment.etc."ondemand_tls_helper.py" = {
+      source = ./ondemand_tls_helper.py;
+      mode = "0755";
+    };
+
+    systemd.services.ondemand-tls-helper = {
+      description = "On-demand TLS helper for Caddy (returns 200 for allowed domains or proxies to PDS)";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        ExecStart = "${pkgs.python3}/bin/python3 /etc/ondemand_tls_helper.py";
+        User = "nobody";
+        Restart = "always";
+        RestartSec = 5;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
+  };
+}
diff --git a/servers/kuribo/configuration.nix b/servers/kuribo/configuration.nix
index 06c0507..d9b2c40 100644
--- a/servers/kuribo/configuration.nix
+++ b/servers/kuribo/configuration.nix
@@ -4,8 +4,10 @@
     ../../modules/auto-upgrade.nix
     ../../modules/gc.nix
     ../../users/users.nix
+    ./caddy.nix
     ./pds.nix
     ./tangled.nix
+    ./papermario-dx-build.nix
   ];
 
   networking.hostName = "kuribo";
diff --git a/servers/kuribo/ondemand_tls_helper.py b/servers/kuribo/ondemand_tls_helper.py
index 16eb4fb..64ff303 100644
--- a/servers/kuribo/ondemand_tls_helper.py
+++ b/servers/kuribo/ondemand_tls_helper.py
@@ -24,7 +24,7 @@ LISTEN_PORT = int(os.environ.get("LISTEN_PORT", "8081"))
 TIMEOUT = float(os.environ.get("TIMEOUT", "5.0"))
 
 # Allowed domain values (lowercase)
-ALLOWED = {"pds", "knot", "spindle"}
+ALLOWED = {"pds", "knot", "spindle", "papermario-dx"}
 
 # Configure logging to stderr (systemd/journal-friendly)
 logging.basicConfig(
diff --git a/servers/kuribo/papermario-dx-build.nix b/servers/kuribo/papermario-dx-build.nix
new file mode 100644
index 0000000..86e0d3f
--- /dev/null
+++ b/servers/kuribo/papermario-dx-build.nix
@@ -0,0 +1,65 @@
+{ config, pkgs, ... }:
+{
+  sops.secrets."papermario-dx/baseromUrl" = {
+    sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
+    format = "json";
+    key = "baseromUrl";
+  };
+  sops.secrets."papermario-dx/sccache/endpoint" = {
+    sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
+    format = "json";
+    key = "sccache/endpoint";
+  };
+  sops.secrets."papermario-dx/sccache/bucket" = {
+    sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
+    format = "json";
+    key = "sccache/bucket";
+  };
+  sops.secrets."papermario-dx/sccache/accessKey" = {
+    sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
+    format = "json";
+    key = "sccache/accessKey";
+  };
+  sops.secrets."papermario-dx/sccache/secretKey" = {
+    sopsFile = ../../secrets/kuribo/papermario-dx-build.json;
+    format = "json";
+    key = "sccache/secretKey";
+  };
+
+  systemd.services.papermario-dx-build-json = {
+    description = "Generate papermario-dx build.json from sops secrets";
+    wantedBy = [ "caddy.service" ];
+    before = [ "caddy.service" ];
+    after = [ "sops-nix.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = let
+      s = name: config.sops.secrets."papermario-dx/${name}".path;
+    in ''
+      mkdir -p /run/papermario-dx
+      cat > /run/papermario-dx/build.json <<ENDJSON
+      {
+        "baseromUrl": "$(cat ${s "baseromUrl"})",
+        "sccache": {
+          "endpoint": "$(cat ${s "sccache/endpoint"})",
+          "bucket": "$(cat ${s "sccache/bucket"})",
+          "accessKey": "$(cat ${s "sccache/accessKey"})",
+          "secretKey": "$(cat ${s "sccache/secretKey"})"
+        }
+      }
+      ENDJSON
+      chmod 644 /run/papermario-dx/build.json
+    '';
+  };
+
+  # Serve the decrypted build.json at papermario-dx.starhaven.dev
+  starhaven.caddy.extraHandles = ''
+    @papermario-dx host papermario-dx.starhaven.dev
+    handle @papermario-dx {
+      root * /run/papermario-dx
+      file_server
+    }
+  '';
+}
diff --git a/servers/kuribo/pds.nix b/servers/kuribo/pds.nix
index afe9a09..94e38b7 100644
--- a/servers/kuribo/pds.nix
+++ b/servers/kuribo/pds.nix
@@ -34,53 +34,23 @@ in
     };
   };
 
-  services.caddy = {
-    enable = true;
-    package = pkgs.caddy.withPlugins {
-      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.2" ];
-      hash = "sha256-ea8PC/+SlPRdEVVF/I3c1CBprlVp1nrumKM5cMwJJ3U=";
-    };
-    email = pdsSettings.PDS_ADMIN_EMAIL;
-    globalConfig = ''
-      on_demand_tls {
-        ask http://127.0.0.1:8081
-      }
-
-      acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
-    '';
-    virtualHosts."*.starhaven.dev" = {
-      extraConfig = ''
-        tls {
-          on_demand
-        }
-
-        handle / {
-          redir https://starhaven.dev
-        }
+  # Caddy config
+  starhaven.caddy.adminEmail = pdsSettings.PDS_ADMIN_EMAIL;
+  starhaven.caddy.extraHandles = ''
+    handle /xrpc/app.bsky.unspecced.getAgeAssuranceState {
+      header content-type "application/json"
+      header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy"
+      header access-control-allow-origin "*"
+      respond `{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured"}` 200
+    }
+  '';
+  starhaven.caddy.fallbackHandle = ''
+    handle {
+      reverse_proxy http://127.0.0.1:${toString pdsSettings.PDS_PORT}
+    }
+  '';
 
-        @knot host ${toString config.services.tangled.knot.server.hostname}
-        handle @knot {
-          reverse_proxy http://${toString config.services.tangled.knot.server.listenAddr}
-        }
-
-        @spindle host ${toString config.services.tangled.spindle.server.hostname}
-        handle @spindle {
-          reverse_proxy http://${toString config.services.tangled.spindle.server.listenAddr}
-        }
-
-        handle /xrpc/app.bsky.unspecced.getAgeAssuranceState {
-          header content-type "application/json"
-          header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy"
-          header access-control-allow-origin "*"
-          respond `{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured"}` 200
-        }
-
-        handle {
-          reverse_proxy http://127.0.0.1:${toString pdsSettings.PDS_PORT}
-        }
-      '';
-    };
-  };
+  # Caddy needs the PDS env file for CLOUDFLARE_API_TOKEN
   systemd.services.caddy = {
     after = [
       "ondemand-tls-helper.service"
@@ -89,27 +59,7 @@ in
     serviceConfig.EnvironmentFile = config.sops.secrets.pds.path;
   };
 
-  environment.etc."ondemand_tls_helper.py" = {
-    source = ./ondemand_tls_helper.py;
-    mode = "0755";
-  };
-
-  systemd.services.ondemand-tls-helper = {
-    description = "On-demand TLS helper for Caddy (returns 200 for allowed domains or proxies to PDS)";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
-
-    serviceConfig = {
-      ExecStart = "${pkgs.python3}/bin/python3 /etc/ondemand_tls_helper.py";
-      Environment = "PDS_PORT=${toString pdsSettings.PDS_PORT}";
-      User = "nobody";
-      Restart = "always";
-      RestartSec = 5;
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
+  # On-demand TLS helper proxies unknown domain checks to PDS
+  systemd.services.ondemand-tls-helper.serviceConfig.Environment =
+    "PDS_PORT=${toString pdsSettings.PDS_PORT}";
 }
diff --git a/servers/kuribo/tangled.nix b/servers/kuribo/tangled.nix
index 6c217a4..2e0a62e 100644
--- a/servers/kuribo/tangled.nix
+++ b/servers/kuribo/tangled.nix
@@ -1,3 +1,4 @@
+{ config, ... }:
 let
   owner = "did:plc:tjgdahiw3u2djgnigyqeummg";
 in
@@ -25,4 +26,17 @@ in
       };
     };
   };
+
+  # Caddy: reverse proxy to knot and spindle
+  starhaven.caddy.extraHandles = ''
+    @knot host ${toString config.services.tangled.knot.server.hostname}
+    handle @knot {
+      reverse_proxy http://${toString config.services.tangled.knot.server.listenAddr}
+    }
+
+    @spindle host ${toString config.services.tangled.spindle.server.hostname}
+    handle @spindle {
+      reverse_proxy http://${toString config.services.tangled.spindle.server.listenAddr}
+    }
+  '';
 }